Nevada-based medical transcription service provider Perry Johnson & Associates said a massive cyber attack it suffered last year affected more than 13 million patients of Concentra Health Services.
Last year, Perry Johnson & Associates said its internal network was infiltrated by an unauthorised third party between March 27 and May 2. The cyber attack enabled the threat actor to access and acquire copies of certain files from its internal systems.
PJ&A said it immediately launched an internal investigation with assistance from third party cyber security experts to understand the nature and scope of the security incident.
The investigation revealed that the threat actor was able to access sensitive healthcare information of a large number of individuals. The compromised information included names, dates of birth, addresses, Social Security numbers, medical record numbers, hospital account numbers, admission diagnosis, dates and times of service, insurance information, clinical information from medical transcription files, including laboratory and diagnostic test results, medications, name of the treatment facility, and the name of healthcare providers.
In a filing with the U.S. Department of Health and Human Services Office for Civil Rights, the company reported that at least 8,952,212 individuals were affected by the incident.
In January, Texas-based physical and occupational therapy provider Concentra Health Services filed a notice of data security incident with the U.S. Department of Health and Human Services (HHS). According to the filing, the data breach, which was a result of a data security incident suffered by PJ&A, affected at least 3,998,162 Concentra patients.
On February 8, in a filing with the Office of the Maine Attorney General, PJ&A filed a notice of data security incident on behalf of Concentra Health Services. According to the filing, after reviewing the impacted data to identify the affected individuals, PJ&A notified Concentra of the incident, which was followed by an investigation by the Texan therapy provider.
“PJ&A notified Concentra of the event, as required, and provided Concentra with a list of its potentially impacted patients. Concentra promptly launched its own investigation and worked as quickly as possible to validate the results of PJ&A’s review and locate missing address information. Concentra completed this process recently, and then we moved as quickly as possible to notify you of the same,” Concentra said in a letter to affected customers.
The compromised data included the names and other personal identifiers along with Social Security Numbers. PJ&A’s filing with the state regulator also revealed that at least 13,300,750 individuals were impacted by the data breach.
“Upon becoming aware of the event, we moved quickly to investigate and respond to the event, assess the security of our systems, and notify potentially affected individuals. We are notifying potentially affected individuals, including you, so that you may take further steps to best protect your information, should you feel it is necessary to do so. We regret any inconvenience or concern this event may cause,” the company added.
PJ&A has urged all impacted individuals to remain vigilant and keep an eye out for any suspicious activities in their credit reports. It is also offering complimentary credit monitoring and identity theft protection services through IDX to the recipients of the data breach notice. Along with this, PJ&A has also set up a dedicated helpline where impacted individuals can call and get their queries answered.
